chore(deps): update all dependencies to latest and fix GitHub Actions drift

[spathon]

Resolves the three security advisories from the GitHub alert digest, and brings every remaining dependency to its latest version.

Security advisories

All three are fixed by a lockfile refresh alone — the patched versions already satisfied the existing ranges, so no manifest change was required for them.

Dependency	Was	Now	Advisory
picomatch (nested under @prefresh/vite)	2.3.1	2.3.2	GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
@babel/core	7.29.0	7.29.7	GHSA-4x5r-pxfx-6jf8
postcss	8.5.15	8.5.25	GHSA-r28c-9q8g-f849

npm audit now reports 0 vulnerabilities, npm outdated is empty.

Dependency updates

preact 10.29.8 · preact-iso 2.12.1 · preact-render-to-string 6.7.0 · @preact/preset-vite 2.10.6 · vite 8.2.0 · biome 2.5.7 · baseline-browser-mapping 2.11.12 · typescript 7.0.2

TypeScript 5.9 → 7.0

The major is the native (Go) compiler port. Verified safe here before bumping — tsconfig.json is unchanged and tsc --noEmit passes clean:

• No compiler API usage. 7.0 ships without the API until 7.1, which breaks ts-morph / ts-jest / typescript-eslint. Nothing in this repo imports typescript, and no package in the tree depends on it — tsc --noEmit is the only consumer.
• No removed option in use: target is ES2022, module ESNext, moduleResolution bundler; no baseUrl, downlevelIteration, namespaces, enums, decorators, or import assertions.
• No changed default bites: strict and noUncheckedSideEffectImports were already explicitly true; rootDir is moot under noEmit; the new types: [] default is moot as there are no @types/* direct deps, triple-slash refs, or import.meta.env usage.

Biome 2.4 → 2.5

2.5 deprecated linter.rules.recommended. Migrated via biome migrate to the equivalent "preset": "recommended". Confirmed the active rule set is unchanged — both a preset rule (noDoubleEquals) and the explicit noConsole override still fire.

GitHub Actions — all five were a full major behind

Action	Was	Now
actions/checkout	v6	v7
actions/setup-node	v6	v7
actions/configure-pages	v5	v6
actions/upload-pages-artifact	v3	v5
actions/deploy-pages	v4	v5

Release notes reviewed: these majors are runner-runtime bumps (Node 24) and internal dependency updates — no input/output changes affecting our usage, which is only node-version and path. upload-pages-artifact v5 and deploy-pages v5 are a matched pair, keeping the Pages artifact format aligned.

Root cause: Dependabot without a config file only opens security PRs — version updates and the github-actions ecosystem both require .github/dependabot.yml. That's why the npm CVEs reached us as a digest email while the Actions drift stayed invisible. This PR adds that config (weekly, npm + github-actions, minor/patch grouped into one PR so majors stay reviewable).

Drive-by fixes

• npm run format never formatted. biome format without --write only checks — verified by running it against a deliberately misformatted file and seeing no change. Now biome format --write. lint stays check-only for CI.
• package.json: removed "main": "index.js" (that file does not exist), added "private": true, filled in the empty description.

Verification

• npm ci, npm test (lint + typecheck), npm run build — all exit 0
• npm audit — 0 vulnerabilities; npm outdated — empty
• Workflow and Dependabot YAML parsed and step lists asserted
• Manual browser pass (static checks don't cover the preact 10.29 / preact-iso 2.12 bump), 0 console errors:
  • All five join types semantically correct — INNER excludes the orphan like and like-less users; OUTER yields 7 rows with Albert|NULL, Elizabeth|NULL, NULL|Rugby; ANTI yields only the two NULL rows. is-null / is-not-selected highlighting intact.
  • ModalAdd: adding a like for Albert put Albert|Chess in the result and dropped is-not-selected 3→2.
  • i18n lazy-loaded locale chunks load on switch; theme context cycles light→dark→system and persists.
  • Prerender emits / and the five non-English locale chunks split correctly, with en inlined in main and not duplicated.

Reviewer note

test.yml runs on this PR, so checkout@v7 and setup-node@v7 are proven by CI here. The three Pages actions only run on push to main and cannot be verified until merge — if the deploy fails afterwards, those are the suspects, and reverting static.yml alone restores the previous deploy path.

🤖 Generated with Claude Code